Over the past year, multiple water and wastewater plants across the state have been the targets of attempted cyberattacks, according to Vermont Rural Water Association executive director Liz Royer.
In one instance, a wastewater operator lost control of the pretreatment system and failed to warn a wastewater plant downstream because they did not know the threat could be compounded.
In another town, an employee noticed mouse movements on the system’s computer and an investigation later found that multiple systems had been compromised, Royer told lawmakers.
Just in the past month, Royer said, those cyberattacks have increased.
Facilities are also on high alert after a national advisory from the federal government warned water and wastewater operators earlier this month that Iranian-affiliated groups were targeting municipal infrastructure tied to the internet.
In the Vermont Statehouse, officials are discussing how to tighten security at the state’s many municipal water facilities, but so far they've shied away from adding new requirements out of concern that they’ll overburden the often under resourced systems.
The state has just over 400 public community water systems, and according to Roy, a majority of those systems are managed by volunteer boards and owned by organizations such as fire districts or water co-ops. As more sophisticated technologies become available to rural water and wastewater operators, these local systems have become vulnerable to an expanding array of threats.
Vermont lawmakers and state public safety and water officials are trying to come up with strategies to reduce the threats.
“I do think that our water system regulation is evolving a little bit as some of these systems get to be more sophisticated,” said Addison County Sen. Ruth Hardy, who introduced a cybersecurity and smart meter bill this year.
Hardy originally wanted a provision that would require water systems to adopt cybersecurity measures as part of their state permitting process.
Last month, New York passed what it called the first-in-the-nation cybersecurity water infrastructure law, which includes reporting requirements when there is a cybersecurity incident.
But Royer and state officials have opposed stronger regulations here in Vermont, instead advocating for guidance and potentially increased financial support to allow system operators to update their technologies and protocols.
“Quite a few of these systems would need to increase their computer-based security programs, install firewalls, update all of their equipment and their software,” Royer said in an interview. “We do the best with what we have in Vermont, but we don’t always have the latest technology. So even a smaller amount of funding would go a long way towards helping these systems, especially the rural systems.”
Megan Young, the state’s drinking water and groundwater protection division manager, said in an interview that “because the cybersecurity environment is so varied system to system, one-size-fits-all cybersecurity requirements are not applicable to all systems.”
Young also said the state’s Cybersecurity Advisory Council and the Agency of Natural Resources already provide guidance to public water systems.
Vermont created the council in 2023 to bring together public safety, technology and municipal officials to discuss and address the increasing attacks on water and electric infrastructure, health care and supply chain industries.
But there’s still plenty of gaps in the state’s understanding of the risks.
The state does not know which water and wastewater systems are connected to the internet, and water system operators do not currently have to tell the state when their operating systems are compromised. If they lose customer data, however, there are federal and state reporting requirements.
Royer, who declined to provide details about which towns have been affected by the attempted cyberattacks, said making that information public could help other cyber criminals identify vulnerable systems.
Cybersecurity Advisory Council member Shawn Nailor said Vermont’s smallest public water supplies are protected because many of the smallest water systems still run their systems without online computer technologies. Valves are turned by hand, and chemicals are measured out and distributed without computers.
But he said municipal systems are most at risk because they have introduced online programs, and many municipalities are short on staff, and money. And even within the water district, if there is a choice between fixing a broken water line on Main Street or investing in cybersecurity, there is often not enough money available to do both.
“Regardless of what the operators want to do, the ones that are owned by municipalities are at the budget constraints of the entire town,” Nailor said. “If they’re not prioritizing water-wastewater security, competing interests within that municipality get the attention. There are a lot of competing interests for the limited funds that are available.”
